Forum Discussion
Issue with date modified for NTUSER.DAT
- Feb 23, 2018
Here is the code from the script:
#Purpose: Used to set the ntuser.dat last modified date to that of the last modified date on the user profile folder.
#This is needed because windows cumulative updates are altering the ntuser.dat last modified date which then defeats
#the ability for GPO to delete profiles based on date and USMT migrations based on date.$ErrorActionPreference = "SilentlyContinue"
$Report = $Null
$Path = "C:\Users"
$UserFolders = $Path | GCI -DirectoryForEach ($UserFolder in $UserFolders)
{
$UserName = $UserFolder.Name
If (Test-Path "$Path\$UserName\NTUSer.dat")
{
$Dat = Get-Item "$Path\$UserName\NTUSer.dat" -force
$DatTime = $Dat.LastWriteTime
If ($UserFolder.Name -ne "default"){
$Dat.LastWriteTime = $UserFolder.LastWriteTime
}
Write-Host $UserName $DatTime
Write-Host (Get-item $Path\$UserName -Force).LastWriteTime
$Report = $Report + "$UserName`t$DatTime`r`n"
$Dat = $Null
}
}
Just want to say a big thanks for the powershell script. I've been tearing my hair out with this problem for several months.
We changed over some of our school estate to SSD's last year and their getting filled up quite quickly now and I couldn't work out why the normal Group Policy for removing profiles wasn't working.
Changing to the date on the folder isn't perfect as something else sometimes modified it as well but it's a step in the right direction.
Hopefully MS can sort it out.
Can you tell me how you put this in place?
Does it work side by side with the existing GPO or, is this a stand alone script?
We are having issue you are/were having.....
- Joe_FriedelNov 08, 2018Brass Contributor
Yes, the script is used in combination with the GPO setting. We still have the "Delete user profiles older than a specified number of days on system restart" configured. The PowerShell script to adjust the timestamps on the NTUser.dat files is executed on a daily schedule by ConfigMgr using a package with the script as the source file and a program running the following command line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file Change_NTUSER_Date.ps1
The program is deployed to always rerun. You could also accomplish this with a scheduled task running the script on each computer as well. It seemed easiest to use ConfigMgr to handle the distribution and execution of the script which also makes it easy to change, if needed.
- Christopher CurrivanNov 14, 2018Copper Contributor
I was going to test run the script on a subject machine, when I discovered that the timestamp for both the chosen profile folders and the corresponding NTUSER.DAT files were exactly the same. The time stamp for both was more than one month old and they should have been deleted already, but they were still there. Thus far, I've found articles claiming that either the anti-virus software is to blame or the Windows Update service is to blame. In the test case I was working with, there is active anti-virus software, but the Windows Updates are temporarily disabled through Group Policy settings. But, again, the timestamps don't appear to be changing, anyway. Sounds like a Microsoft glitch, to me, or perhaps I'm misunderstanding something.
- Christopher CurrivanJun 17, 2021Copper ContributorIn my response, the last mention of timestamps , I believe I meant to say the timestamps appear to be changing, not don't appear?